Is Your Android TV Streaming Box Part of a Botnet?

The Dark Side of Android TV Streaming Boxes: Are You Part of a Botnet?

When it comes to streaming TV shows and movies, consumers are spoiled for choice. With the rise of subscription-based services like Netflix, Hulu, and Amazon Prime, it's never been easier to access a vast library of content from the comfort of our own homes. However, a growing trend in the tech world has raised concerns about the security and legitimacy of some Android TV streaming boxes on the market.

These devices, often sold at affordable prices, promise to deliver a wide range of channels and content without the need for a monthly subscription. But experts warn that these boxes may be part of a larger problem – a botnet of compromised devices that are being used for malicious activities like advertising fraud and account takeovers.

The Superbox Scandal

One such device is the Superbox, a media streaming box that has been sold at retailers like BestBuy and Walmart for around $400. On the surface, it seems like a steal – offering unlimited access to over 2,200 pay-per-view and streaming services like Netflix, ESPN, and Hulu. But security experts warn that these devices require intrusive software that forces the user's network to relay Internet traffic for others, often tied to cybercrime activity.

Ashley, a senior solutions engineer at Censys, a cyber intelligence company, has been studying the Superbox devices and found some disturbing red flags. "I'm sure a lot of people are thinking, 'Hey, how bad could it be if it's for sale at the big box stores?' But the more I looked, things got weirder and weirder," she said.

The Grass Network

One of the apps that enable the streaming on Superbox devices is called Grass, a decentralized network that allows users to earn rewards by sharing their unused Internet bandwidth with AI labs and other companies. However, experts warn that Grass is being used by malicious actors to tunnel traffic for ad fraud and account takeovers.

Grass founder Andrej Radonjic told KrebsOnSecurity that Grass has implemented a robust system to identify network abusers and has taken steps to prevent misuse. However, Radonjic acknowledged that Grass has undergone corporate clean-ups over the last couple of years, which may have raised concerns about the company's legitimacy.

The Badbox 2.0 Botnet

In July 2025, Google filed a lawsuit against 25 unidentified defendants dubbed the "BadBox 2.0 Enterprise," which Google described as a botnet of over ten million Android streaming devices that engaged in advertising fraud. The lawsuit came on the heels of a June 2025 advisory from the Federal Bureau of Investigation (FBI), which warned that cyber criminals were gaining unauthorized access to home networks by configuring the products with malicious software prior to the user's purchase or infecting the device as it downloads required applications.

The IPidea Proxy Network

Riley Kilmer, founder of Spur, a company that tracks residential proxy networks, said that Badbox 2.0 was used as a distribution platform for IPidea, a China-based entity that is now the world's largest residential proxy network. Kilmer and others say IPidea is merely a rebrand of 911S5 Proxy, a China-based proxy provider sanctioned last year by the U.S. Department of the Treasury for operating a botnet that helped criminals steal billions of dollars from financial institutions, credit card issuers, and federal lending programs.

The Risks of Using Android TV Streaming Boxes

Experts warn that using Android TV streaming boxes can pose a significant risk to users, including:

Unauthorized access to sensitive information
Malware and virus infections
Identity theft and account takeovers
Exposure to phishing and other online scams
Compromise of home networks and devices

What to Look for When Buying an Android TV Streaming Box

When buying an Android TV streaming box, look for the following:

Check the device's security features, such as encryption and firewalls
Research the manufacturer and read reviews from other users
Be wary of devices that offer "free" or "unlocked" content
Avoid devices that require you to disable Google Play Protect settings
Look for devices that are certified by Google Play Protect

Conclusion

The rise of Android TV streaming boxes has raised concerns about the security and legitimacy of some devices on the market. While some devices may offer legitimate streaming services, others may be part of a larger problem – a botnet of compromised devices that are being used for malicious activities. By being aware of the risks and taking steps to protect yourself, you can enjoy streaming your favorite TV shows and movies while staying safe online.

Source: https://krebsonsecurity.com/2025/11/is-your-android-tv-streaming-box-part-of-a-botnet/